Question 1

A retail business is considering outsourcing its IT infrastructure to a cloud service provider. To assess the risk level after transferring some of the IT responsibilities to the third party, which type of risk rating should be evaluated?

Options :

A : Target risk, as it reflects the desired risk level after outsourcing.

B : Inherent risk, as it represents the baseline risk without considering the outsourcing.

C : Residual risk, as it indicates the remaining risk after outsourcing.

D : Transferred risk, as it accounts for the risk shifted to the cloud service provider.

Answer: D

Question 2

A healthcare provider is evaluating the risk of unauthorized access to electronic health records (EHRs). The provider's risk criteria prioritize patient confidentiality and regulatory compliance. How should the risk level be assessed in this scenario?

Options :

A : Moderate, given the presence of basic access controls.

B : High, due to the critical importance of maintaining patient confidentiality and meeting regulatory requirements.

C : Low, as there is a low probability of such an incident occurring.

D : Negligible, assuming the healthcare provider conducts regular security audits.

Answer: B

Question 3

An online retail company is assessing the risk of unauthorized access to customer credit card information. They are evaluating the implementation of end-to-end encryption for all transactions, regularly updating their payment systems, conducting penetration testing, or outsourcing payment processing to a PCI DSS compliant third-party. Which option most effectively reduces the risk level of unauthorized access to customer information?

Options :

A : Implementing end-to-end encryption for all transactions.

B : Outsourcing payment processing to a PCI DSS compliant third-party.

C : Regularly updating their payment systems.

D : Conducting penetration testing.

Answer: A

Question 4

A university is facing risks associated with the unauthorized disclosure of confidential research data. They are considering encrypting all research data, restricting data access to a few key researchers, regularly auditing data access, or a combination of these measures. Which option aligns best with ISO/IEC 27005's guidance on proportionate and effective risk treatment?

Options :

A : Encrypting all research data.

B : A combination of encrypting data, restricting access, and regular audits.

C : Restricting data access to a few key researchers.

D : Regularly auditing data access.

Answer: B

Question 5

A hospital's electronic health record (EHR) system is infected with ransomware, encrypting patient records. What is the primary consequence of this ransomware attack in terms of the CIA triad?

Options :

A : Financial losses due to paying the ransom.

B : Loss of availability of patient records for healthcare providers.

C : Unauthorized disclosure of patient health information.

D : Permanent deletion of patient records, impacting data integrity.

Answer: B

Higher Test Marks with Free Online ISO-27005-LRM Exam Practice

Buying Options: